feat: 接入 SSF 实时会话撤销

docker/nginx.conf

@@ -10,6 +10,29 @@ server {
     return 308 /gateway-api/;
   }
 
+  # RFC 8935 receiver: exact path, no redirect, short bounded upstream timeout.
+  location = /api/v1/security-events/ssf {
+    client_max_body_size 64k;
+    client_body_buffer_size 64k;
+    client_body_timeout 5s;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Connection "";
+    proxy_connect_timeout 3s;
+    proxy_read_timeout 10s;
+    proxy_send_timeout 10s;
+    proxy_redirect off;
+    proxy_pass http://api:8088;
+  }
+
+  # Metrics stay on the API's monitoring network and are not exposed by Web.
+  location = /gateway-api/metrics {
+    return 404;
+  }
+
   location /gateway-api/ {
     proxy_http_version 1.1;
     proxy_set_header Host $host;